The Role
Develop, test, deploy, troubleshoot, and optimize Logstash pipelines and Grok parsers for high-volume security and infrastructure logs. Normalize events to ECS or SIEM schemas, resolve parsing and ingestion issues, diagnose Elasticsearch mapping errors, and ensure reliable, lossless pipeline performance. Conduct regression testing, root-cause analysis, production stabilization, documentation, and L2 support while mentoring junior engineers and coordinating with SOC, integration, product, and engineering teams.
Summary Generated by Built In
Logstash Developer Engineer – L2
Role Summary
Role Summary
We are looking for a hands-on Logstash Developer Engineer – L2 responsible for developing, enhancing, troubleshooting, and optimizing Logstash pipelines and Grok parsers for diverse security and infrastructure log sources. The engineer should independently handle complex parsing and ingestion issues while ensuring zero log loss, accurate ECS field mapping, and optimal pipeline performance.
Key Responsibilities- Develop, enhance, test, and deploy Logstash pipelines and Grok patterns for security, network, cloud, application, database, and OS log sources.
- Independently troubleshoot Not Grokked events, parsing failures, log drops, delays, incorrect tagging, and pipeline-routing issues.
- Parse and normalize logs into Elastic Common Schema (ECS) or defined SIEM schemas.
- Work with Grok, Dissect, JSON, KV, Mutate, Date, Ruby and other Logstash filters.
- Validate raw-to-parsed event flow and ensure all intended fields are correctly extracted and mapped.
- Handle multiline, nested JSON, variable-format and high-volume log sources.
- Troubleshoot end-to-end ingestion across Syslog/Filebeat/Elastic Agent → Logstash → Kafka/Redis → Elasticsearch/SIEM environments.
- Perform Grok regression and validation before production deployment to ensure no field loss or parsing rework.
- Optimize Logstash configurations for throughput, CPU/memory utilization, queue management and pipeline stability.
- Diagnose Elasticsearch indexing/mapping errors related to ingestion pipelines.
- Work with REST APIs and API-based collectors; working knowledge of Python for log collection/transformation is preferred.
- Perform RCA for recurring parsing/ingestion issues and maintain SOPs, KEDB, validation checklists and lessons learned.
- Provide L2 support, technical guidance and KT to L1/Integration engineers, reducing dependency on individual developers.
- Coordinate with SOC, Integration, Product and Engineering teams for complex issues and production deployments.
Must Have: Logstash, Grok/Dissect, Regex, Elasticsearch, ECS mapping, Linux, Syslog, JSON, REST APIs, troubleshooting and performance optimization.
Good to Have: Kafka, Redis, Filebeat/Elastic Agent, Python, Git, SQL, cloud log sources (AWS/Azure/GCP), SIEM platforms and cybersecurity log-source knowledge.
Expected L2 CompetencyThe candidate should be capable of independently owning a log source from raw-log analysis through Grok development, validation, deployment and production stabilization. L2 engineers should troubleshoot complex ingestion problems, perform RCA, optimize existing pipelines, mentor junior engineers, and deliver solutions with minimal rework and dependency on senior resources.
Key Success Measures- Grok/parser accuracy and ECS compliance
- Reduction in Not Grokked/parsing backlog
- Minimal post-deployment defects and rework
- No unintended log loss or ingestion delay
- Faster parser development and issue-resolution turnaround
- Pipeline stability and performance
- Quality of RCA, KEDB and technical documentation
Skills Required
- Experience with Logstash pipeline development and optimization
- Experience with Grok, Dissect, Regex, and Logstash filters
- Experience with Elasticsearch and ECS field mapping
- Knowledge of Linux, Syslog, and JSON
- Experience with REST APIs
- Troubleshooting and performance optimization experience
- Experience with Kafka, Redis, Filebeat, or Elastic Agent
- Working knowledge of Python
- Experience with Git and SQL
- Experience with AWS, Azure, or GCP log sources
- Knowledge of SIEM platforms and cybersecurity log sources
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Infosec is a cybersecurity education company that helps IT and security professionals advance their careers and helps employees become safer online at work and home. Its offerings include Infosec Skills, with more than 1,400 hands-on cybersecurity courses and instructor-led certification boot camps, and Infosec IQ, which provides security-awareness training. Its mission is to equip individuals and organizations to outsmart cybercrime.
